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DETAILED ACTION 
Response to Arguments 

1 . In response to communications filed on 1/1 1/2006, applicant does amend claims 
1, 4. 6. 13 and 17-20 : cancels claim 2 . The following claims, claims 1 and 3-20 are 
presented for examination. 



1.1 Applicant's arguments with respect to claims 1 and 3-20 have been considered 
but are moot in view of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 

form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for 
patent by another filed in the United States before the invention thereof by the 
applicant for patent, or on an international application by another who has fulfilled 
the requirements of paragraphs (1), (2), and (4) of section 371(c) of this title 
before the invention thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act 
of 1999 (AlPA) and the Intellectual Property and High Technology Technical 
Amendments Act of 2002 do not apply when the reference is a U.S. patent 
resulting directly or indirectly from an international application filed before 
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November 29, 2000. Therefore, the prior art date of the reference is determined 
under 35 U.S.C. 102(e) prior to the amendment by the AlPA (pre-AlPA 35 U.S.C. 
102(e)). 



Claims 1.4 and 5 are rejected under 35 U.S.C. 102(e) as being disclosed by 
Brezak et al. (U.S. Patent Publication No. 20030018913). 

Regarding claim 1 . Brezak etaL . discloses a communication authorization 
method, comprising the steps of: 

• A third party server receiving a request for access information to access 
content (0042); 

• generating the access information to access the desired content from a 
first application server (0045); 

• generating authentication of the access information using a first service 
ticket to the first application server (0046-0048); and 

• sending the access information and authentication to a client, whereby the 
client presents the access information and authentication to the first 
application server to be authorized to receive the desired content from the 
first application server (0048). 

Regarding claim 4 , Brezak et al. . discloses the method as claimed in claim 1, 
further comprising the step of: generating at least a portion of the authentication 
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using the first service ticket (0048). 

Regarding claim 5 , Brezak et a!. , discloses the method as claimed in claim 4, 
further comprising the steps of: 

• requesting a ticket granting ticket (TGT ticket) (0004); 

• receiving a TGT ticket (0005); 

• requesting the third party server service ticket for the first application 
server (0008); and 

• receiving the third party server service ticket for the first application server 
(0008). 

Claim Rejections - 35 USC § 103 

3. Claims 3 and 6-20 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Brezak et al. as applied to claims 1. 4 and 5 above, and further in view of 
Kato (US Patent Number 6,381 ,331 B1). 

Regarding claim 3 . Brezak et al. is silent in disclosing the step of generating the 
access information including generating session rights and encrypting at least a 
portion of the session rights using a third party server service key for the first 
application server. 
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Kato discloses an "information sending system and method, which can send 
encrypted information which can be decrypted in units of portions of the 
information," comprising information (access information) segmentation 
means for segmenting information into a plurality of blocks and encrypting the 
plurality of segmented blocks (portion of the session rights) using a first key 
(third party server service key) (col. 1 lines 47-63 of Kato). 

It would have been obvious to a person of ordinary skill in the art, at the time 
of the invention, to have been motivated to apply the infomnation 
segmentation and first key encryption means of Kato with the system and 
method for constrained delegation of authentication credentials of Brezak et 
aL Motivation for this combination is recited by Kato whereby it is disclosed 
that the infomnation sending system, of Kato, encrypts outgoing information 
with different keys, and the first and second keys for decrypting these blocks 
are encrypted by different keys and are added to the outgoing infomnation, 
allowing for different persona to either have the ability to decrypt blocks of 
information encoded with either one or both keys - it allows for added security 
(col. 2 lines 19-29). Therefore, Brezak et al. presents a method for 
constrained delegation of authentication credentials without explicitly reciting 
the features of security inherent in an authentication service (server) - 
although implied due to the basic functionality of an authentication server. 
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Kato explicitly recites these security features which comprise the claimed 
security features of the applicant as noted above. 

Regarding claim 6 . Brezak et aL . the method as claimed in claim 1, further 
comprising the steps of: 

• verifying the authentication of the access information using the first service 
ticket, and client authorization (0046-0048 of Brezak et al.) : and 

• issuing a key reply if the authentication of the access information and 
client authorization are verified (0048 of Brezak et a!.) , 

Brezak et al. are silent in disclosing the extracting the access information and 
authentication. 

Kato does disclose the extracting the access information and authentication 
(col. 11 lines 22-27 Kato). 

It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the steps of extracting a session key of Kato with the 
system and method for constrained delegation of authentication credentials of 
Brezak et al. Brezak et al. recites motivation for this combination whereby it 
is disclosed "a method that includes identifying a target service (server) to 
which access is sought on behalf of a client, and causing a server to request 
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a new service credential (key), for use by the server, from a trusted third- 
party" (0008 of BrezaketaJL). Therefore, it would have been obvious to 
combine the steps of extracting a session key of Kato with the system and 
method for constrained delegation of authentication credentials of Brezaket 
a!., as the system and methods of Brezak et al. incorporates the transmission 
of a key request in the request for a "new service credential" - although not 
explicitly stating this key would be "extracted" and sent to the requester. 

Brezak et al. are silent in disclosing the application server receiving a key 
request including the access information and authentication. 

Kato does disclose the delivery of the public key to users, delivery of secret 
key information and notification of download request (key request) (col. 9 
lines 64-67, col. 10 lines 1-4, col. 10 lines 64-67 and col. 11 lines 1-2 of Kato). 

It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the download request (key request) delivery system 
of Kato with the system and method for constrained delegation of 
authentication credentials of Brezak et al. Brezak et aL recites motivation for 
this combination whereby it is disclosed "a method that includes identifying a 
target service (server) to which access is sought on behalf of a client, and 
causing a server to request a new service credential (key), for use by the 
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server, from a trusted third-party (0008 of Brezak et al.) . Kato, as cited 
above, explicitly recites this limitation. Therefore, Brezak. et aL . discloses the 
method for sontrained delegation of authentication credentials - implying use 
of a means for authentication such as the claimed "key" of the applicant. 
Kato explicitly recites usage of the download request analogous in 
functionality to the key request, which it would have been obvious to combine 
with the above method for constrained delegation of authentication 
credentials of Brezak et al. 

Regarding claim 7 . Brezak et al. . the method as claimed in claim 6, further 
comprising the steps of: 

• sending the key request to the first application server (0042 of Brezak et 
aL): and 

• receiving the key reply (KEY_REP) if the authentication of the access 
information and client authorization are verified by the first application 
server (0048 of Brezak et al.) . 

[The Examiner's Reasoning: Because the key is included in the 
transmission of authentication information, the term "KEY_REP" the 
Applicant claim is analogous to "TGS_REP" of Brezak et al.1 



Brezak et al. are silent in disclosing a client generating a key request 
including the access information and the authentication. 
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• Kato does disclose a client generating a key request including the access 
information and the authentication (col. 9 lines 64-67, col. 10 lines 1-4, col. 
10 lines 64-67 and col. 10 lines 1-2 of Kato) : 

[The Examiner's Reasoning: The server receiving a key request implies 
that the request must first be generated by the requests of the client.] 

It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the download request (key request) delivery system 
of Kato with the system and method for constrained delegation of 
authentication credentials of Brezak et al. Brezak et al. recites motivation for 
this combination whereby it is disclosed "a method that includes identifying a 
target service (server) to which access is sought on behalf of a client, and 
causing a server to request a new service credential (key), for use by the 
server, from a trusted third-party (0008 of Brezak et al.) . Kato. as cited 
above, explicitly recites this limitation. Therefore, Brezak. et al. , discloses the 
method for sontrained delegation of authentication credentials - implying use 
of a means for authentication such as the claimed "key" of the applicant. 
Kato explicitly recites usage of the download request analogous in 
functionality to the key request, which it would have been obvious to combine 
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with the above method for constrained delegation of authentication 
credentials of Brezak et al. 

Regarding claim 8 . Brezak et al. . discloses a method for verifying authorization 
for a client to gain access to content and/or services, comprising the steps of: 

• extracting third party server access information and third party server 
authentication from the key request (col. 1 1 lines 22-27 Kato): 

• verifying an authentication of the third party access information and a 
client authorization (0046-0048 of Brezak et al) : and 

• issuing a key reply if the authentication of the third party access 
information and the client authorization are verified (0048 of Brezak et al.) . 

Brezak et al. are silent in disclosing receiving a key request. 

Kato does disclose the receiving a key request (col. 9 lines 64-67, col. 10 
lines 1-4, col. 10 lines 64-67 and col. 1 1 lines 1-2 of Kato). 

It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the steps of extracting a session key of Kato with the 
system and method for constrained delegation of authentication credentials of 
Brezak et al. Brezak et al. recites motivation for this combination whereby it 
is disclosed "a method that includes identifying a target service (server) to 
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which access is sought on behalf of a client, and causing a server to request 
a new service credential (key), for use by the server, from a trusted third- 
party" (0008 of Brezaket_aL). Therefore, it would have been obvious to 
combine the steps of extracting a session key of Kato with the system and 
method for constrained delegation of authentication credentials of Brezaket 
al.. as the system and methods of Brezak et al. incorporates the transmission 
of a key request in the request for a "new service credential" - although not 
explicitly stating this key would be "extracted" and sent to the requester. 

Regarding claim 9 , Brezak et aL , discloses the method as claimed in claim 8, 
further comprising the step of authenticating the third party server access 
information using the third party server authentication (0043 and 0048 of Brezak 
etaL). 

Regarding claim 10 , Brezak et al. . discloses the method as claimed in claim 9, 
wherein the step of authenticating includes extracting a first service ticket from 
the authentication and authenticating the third party server access information 
using the first service ticket (0055 of Brezak et al. ). 

[The Examiner's Reasoning: The disclosed forwarding of the service ticket 
implies extracting service ticket as a ticket must be isolated/extracted 
before being fonA/arded.] 
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Regarding claim 11 . Brezak et a!. , discloses the method as claimed in claim 8, 
wherein the step of extracting the third party server authentication, further 
comprising: 

Brezak et al. are silent in disclosing the step of authenticating the access 
information including verifying a third party server signature using the session 
key. 

Kato does disclose the step of authenticating the access information including 
verifying a third party server signature using the session key (col. 6 lines 42- 
49). 



It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the step of generating the authentication including 
generating a signature utilizing a session key of the third party server service 
ticket of Kato with the system and method for constrained delegation of 
authentication credentials of Brezak et al. Kato recites a motivation for the 
combination, whereby disclosing an infomiation sending system and mail 
wherein data to be sent from sender A is broken up into a plurality of blocks 
and a transmission packet is fonned from those blocks which are encrypted to 
be decryptable by the administrator and the receiver, and blocks which are 
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encrypted to be decryptable by the receiver only. Thus, the encrypted key 
(session key) is encrypted with the public key of the administrator - producing 
a signature of the administrator of the third party server. Therefore, it would 
have been obvious to combine the steps of generating a signature utilizing a 
session key of the third party server service ticket of Kato with the system and 
method for constrained delegation of authentication credentials of Brezak et 
al.. as the system and methods of Brezak et al. incorporate the key request 
and Kato makes use of this key in the generation of signatures, encrypting the 
said key with the administrator's producing a signature. 

Brezak et al. are silent in disclosing the steps of extracting a session key from 
the key request. 

Kato does disclose the steps of extracting a session key from the key request 
(col. 9 lines 64-67, col. 10 lines 1-4, col. 10 lines 64-67 and col. 11 lines 6-52 
of Kato) . 

It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the steps of extracting a session key of Kato with the 
system and method for constrained delegation of authentication credentials of 
Brezak et al. Brezak et al. recites motivation for this combination whereby it 
is disclosed "a method that includes identifying a target service (server) to 
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which access Is sought on behalf of a client, and causing a server to request 
a new service credential (key), for use by the server, from a trusted third- 
party" (0008 of Brezak et al.) . Therefore, It would have been obvious to 
combine the steps of extracting a session key of Kato with the system and 
method for constrained delegation of authentication credentials of Brezak et 
aLj, as the system and methods of Brezak et al. incorporates the transmission 
of a key request in the request for a "new service credential" - although not 
explicitly stating this key would be "extracted" and sent to the requester. 

Regarding claim 12 . Brezak et al. are silent in disclosing the method as claimed 
in claim 11, wherein the step of extracting the session key including decrypting at 
least a portion of the key request using an application server service key and 
extracting the session key. 

Kato does disclose disclosing the method as claimed in claim 1 1 , wherein the 
step of extracting the session key including decrypting at least a portion of the 
key request using an application server service key and extracting the 
session key (col. 1 1 lines 6-52 and col. 12 lines 1-5 of Kato). 

It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the steps of extracting a session key of Kato with the 
system and method for constrained delegation of authentication credentials of 
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Brezak et al. Brezak et al. recites motivation for this combination whereby it 
is disclosed "a method that includes identifying a target service (server) to 
which access is sought on behalf of a client, and causing a server to request 
a new service credential (key), for use by the server, from a trusted third- 
party" (0008 of Brezak et al.) . Therefore, it would have been obvious to 
combine the steps of extracting a session key of Kato with the system and 
method for constrained delegation of authentication credentials of Brezak et 
al.. as the system and methods of Brezak et al. incorporates the transmission 
of a key request in the request for a "new service credential" - although not 
explicitly stating this key would be "extracted" and sent to the requester. 

Regarding claim 13. Brezak et al. , discloses the method as claimed in claim 8, 
further comprising the steps of: 

• the third party server receiving a request for the access information to 
access content (0042 of Brezak et al.) ; 

• generating the third party server access information to access the desired 
content from a first application server (0045 of Brezak et al.) ; and 

• generating the third party server authentication of the access information 
(0046-0048 of Brezak et al.) . 
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Regarding claim 14 , Brezak etaL . discloses the method as claimed in claim 13, 
wherein the step of generating the third party server authentication including 
incorporating a third party server service ticket for the first application server 
(0043-0045 of Brezak et al.) . 

Regarding claim 15 , Brezak et al. , is silent in disclosing the method as claimed in 
claim 14, wherein the step of generating the authentication including generating a 
signature utilizing a session key of the third party server service ticket. 

Kato does disclose the method as claimed in claim 14, wherein the step of 
generating the authentication including generating a signature utilizing a 
session key of the third party server service ticket (col. 6 lines 42-49). 

It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the step of generating the authentication including 
generating a signature utilizing a session key of the third party server service 
ticket of Kato with the system and method for constrained delegation of 
authentication credentials of Brezak et al. Kato recites a motivation for the 
combination, whereby disclosing an information sending system and mail 
wherein data to be sent from sender A is broken up into a plurality of blocks 
and a transmission packet is formed from those blocks which are encrypted to 
be decryptable by the administrator and the receiver, and blocks which are 
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encrypted to be decryptable by the receiver only. Thus, the encrypted key 
(session key) is encrypted with the public key of the administrator - producing 
a signature of the administrator of the third party server. Therefore, it would 
have been obvious to combine the steps of generating a signature utilizing a 
session key of the third party server service ticket of Kato with the system and 
method for constrained delegation of authentication credentials of Brezaket 
al., as the system and methods of Brezak et al. incorporate the key request 
and Kato makes use of this key in the generation of signatures, encrypting the 
said key with the administrator's producing a signature. 

Regarding claim 16 , Brezaket al. , discloses the method as claimed in claim 14, 
wherein the steps of verifying the authentication of the access information 
including verifying the third party server service ticket (0043-0048 of Brezak et 
al). 

Brezak et al. are silent in disclosing the extraction of the third party server 
service ticket. 



Kato does disclose disclosing the extraction of the third party server service 
ticket (col. 1 1 1 lines 22-27 of Kato). 
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It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the steps of extracting a session key of Kato with the 
system and method for constrained delegation of authentication credentials of 
Brezak et al. Brezak et al. recites motivation for this combination whereby it 
is disclosed "a method that Includes identifying a target service (server) to 
which access is sought on behalf of a client, and causing a server to request 
a new service credential (key), for use by the server, from a trusted third- 
party" (0008 of Brezak et a!.) . Therefore, it would have been obvious to 
combine the steps of extracting a session key of Kato with the system and 
method for constrained delegation of authentication credentials of Brezak et 
al.. as the system and methods of Brezak et al. incorporates the transmission 
of a key request in the request for a "new service credential" - although not 
explicitly stating this key would be "extracted" and sent to the requester. 

Regarding claim 17 . Brezak etal. . discloses a method for providing secure 
communication when distributing services, comprising: the steps of: 

• a third party server receiving a selection for services (0042 of Brezak et 
aU; 

• issuing access Infomiation for the services (0045 of Brezak et al.) : 

• issuing authentication of the access information (0046-0048 of Brezak et 
ay; 
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• verifying an authentication of the access information and a client 
authorization utilizing, at least in part, a first service ticket (0048 of Brezak 
et al.) : and 

• issuing a key reply to a client if the authentication of the access 
information and the client authorization are verified (0048 of Brezak et al.) . 

Brezak et al. are silent in disclosing an application server receiving a key 
request from a client. 

Kato does disclose the delivery of the public key to users, delivery of secret 
key information and notification of download request (key request) (col. 9 
lines 64-67, col. 10 lines 1-4, col. 10 lines 64-67 and col. 1 1 lines 1-2 of Kato) . 

It would have been obvious to a person of ordinary skill in the art to have 
been motivated to apply the steps of extracting a session key of Kato with the 
system and method for constrained delegation of authentication credentials of 
Brezak et al. Brezak et al. recites motivation for this combination whereby it 
is disclosed "a method that includes identifying a target service (server) to 
which access is sought on behalf of a client, and causing a server to request 
a new service credential (key), for use by the server, from a trusted third- 
party" (0008 of Brezak et al.) . Therefore, it would have been obvious to 
combine the steps of extracting a session key of Kato with the system and 
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method for constrained delegation of authentication credentials of Brezak et 
al. as the system and methods of Brezak et al. incorporates the transmission 
of a key request in the request for a "new service credential" - although not 
explicitly stating this key would be "extracted" and sent to the requester. 

Regarding claim 18 . Brezak et al. , discloses the method as claimed in claim 17, 
further comprising the steps of: 

• a KDC receiving a first service ticket request from a third party server for 
the application server (0137 and 0141 of Brezak et al) : 

• a KDC issuing the first service ticket to the third party server for the 
application server (0085 of Brezak et al.) : and 

• the steps of the third party issuing access information and authentication 
including generating the access information and authentication using the 
first service ticket (0015 and 0016 of Brezak et al.) . 

Regarding claim 19 . Brezak etal. . discloses the method as claimed in claim 17, 
further comprising the steps of: 

• receiving a second service ticket request for the first server (claims 36 and 
40 of Brezak et al.) : 

• issuing a second service ticket for the application server (claims 36 and 40 
of Brezak et al.) : and 
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• the step of the application server receiving a key request wherein the key 
request includes the second service ticket (claims 36 and 40 of Brezak et 
aL). 

Regarding claim 20 . Brezak et al. , discloses the method as claimed in claim 17, 
wherein: the step of verifying the authentication of the access information 
including: 

• extracting the first service ticket (0055of Brezak et aL) : 

• generating a signature using the session key (0046-0048 of Brezak et al.) : 

Brezak et al. are silent in disclosing the following limitations: 

• decrypting the first service ticket; 

• extracting a session key from the first service ticket; 

• verifying the signature over the access information with the session key. 

Kato does disclose the following limitations: 

• decrypting the first service ticket (col. 2 lines 19-23 of Kato) : 

• extracting a session key from the first service ticket (col. 1 1 lines 6-52 of 
Kato); 

• verifying the signature over the access information with the session key 
(col. 6 lines 42-49 of Kato) . 
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It would have been obvious to a person of ordinary skill in the art to have been 
motivated to apply the steps of extracting a session key of Kato with the system 
and method for constrained delegation of authentication credentials of Brezak et 
al Brezak et aL recites motivation for this combination whereby it is disclosed "a 
method that includes identifying a target service (server) to which access is 
sought on behalf of a client, and causing a server to request a new service 
credential (key), for use by the server, from a trusted third-party" (0008 of Brezak 
et al. ). Therefore, it would have been obvious to combine the steps of extracting 
a session key of Kato with the system and method for constrained delegation of 
authentication credentials of Brezak et al.. as the system and methods of Brezak 
et al. incorporates the transmission of a key request in the request for a "new 
service credential" - although not explicitly stating this key would be "extracted" 
and sent to the requester. 



Conclusion 

5. The prior art made of record, although not relied upon, and considered pertinent 
to applicant's disclosure include: 
U.S. Patent(s): 

6,775.772 Binding et al. 

5,832,228 Holden et al. 

6.067,620 Holden et aL 

5,872,849 Sudia, Frank Wells 
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6.009.177 



Sudia. Frank Wells 



6.684,331 



Srivastava. Sunll K. 



U.S Patent Application Publication(s): 



20030018915 



Stoll. Louis 



20030028762 



Trill et al. 



20040003287 



Zissimopoulos et al. 



20050114666 



Sudia. Frank W. 



6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Chinwendu C. Okoronkwo whose telephone number is 
(571) 272 2662. The examiner can normally be reached on MWF 9:15 - 7:30 and TuTh 
9:00 - 2:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor. Ayaz R. Sheikh can be reached on (571) 272 3795. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status Information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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